17.1 Standard Accounting Files

When accounting is enabled, the Unix kernel writes a record to a binary data file as each process terminates. These files are traditionally stored in the home directory of the standard user adm (/var/adm on most recent systems), although some current systems no longer use that account and simply run the accounting software as root. Nevertheless, for sentimental reasons, the examples in this chapter generally use /var/adm as the location of the accounting data files.

Records written to the rawaccounting file by the System V and BSD accounting systems contain the same data. It is only the ordering of the fields within each record that varies between the flavors (consult the /usr/include/sys/acct.h file for details).^[1] Accounting records contain the following data about each process that runs on the system:

^[1] Linux uses a slight variation on the BSD form.

• Image name (for example, grep)

• CPU time used (separated into user and system time)

• Elapsed time taken for the process to complete (sometimes called "wall clock time")

• Time the process began

• Associated user and group IDs

• Lifetime memory usage (in BSD, the average use of the process' lifetime; in System V, the aggregate sum of the memory in use at each clock tick)

• Number of characters read and written

• Number of disk I/O blocks read and written

• Initiating TTY

• Accounting flags associated with the process

• Process' exit status

Other binary data files store additional accounting data:

utmp

Contains data about each currently logged-in user. login enters a record for each successful login, which is then cleared by init at logout.

wtmp

Logs each login and logout to/from the system.

lastlog

Records the date and time of the last login for each user.

A Thankless Job

There will be days when this tired old saying about system administration will seem one thousand percent correct. On days like those, you'll be battered from encounters with the cynics among your users the ones who know the price of everything but the value of nothing. Don't let them get you down. Having one's worth be undervalued may be an occupational hazard for a system administrator, but you don't have to fall into that particular trap yourself. Just keep in mind that anyone who can put up with the Unix accounting system (in either variety) is worth their weight in gold.